Thanks for pointing that out. My apologies. I did not and do not see that notice on the website.
I received an email regarding the announcement. It didn't include any specifications so I searched "Librem 5 v2" and found this page.
After looking again at the unsolicited email I received - I see the disclaimer at the bottom in italicized text which I've been trained to ignore. It's regrettable the embargo notice was not the first paragraph of the email.
I'm not really sure what to do now. It doesn't appear I can delete a post.
I am using something similar. I then setup an additional container with Caddy that has the API keys and modifies headers so the AI containers never see them. Pi for example can use this setup.
For SSH I've started migrating from one prover wide key to multiple project scoped keys. I was also using SSH inside the container but realized I could just make commits inside and then eventually push from outside.
I think hardening tips for Docker/Podman could warrant its own "Ask HN" post - not just for reducing exposure to agents but also all the recent supply chain attacks.
I have been kicking the tires on yoloai which seems to automate the "intercept API calls to hide API keys" step and the "sandbox the files in a docker container" step, with support for inspecting the files / diff before applying.
I don't quite have it to a smooth workflow for my needs ("research this codebase and draft a plan we can discuss, with code examples") but it seems promising.
I've completed a few square kilometers around my home while walking my dog over the last year. I'd like to get better at remembering to check the app when I'm in different neighborhoods.
With the ease of use of StreetComplete, it really wouldn't take many volunteers in a city to complete all quests. And I'd love for a privacy focused navigation app to also have the best datasets for public roads and businesses.
The feature I don't want to pay for but would be nice to have: deeper level proxied wildcards.
> If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard ¹ ²
When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt for services like 'smart.home.domain.com' (and I think Cloudflare proxied these for free?) but realized I was losing some privacy since the subdomains were describing my network services. I also wasn't aware SSL certificates are a permanent record (though what isn't these days) and I had to be careful what names I was using.
I realized instead I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history. But because Cloudflare doesn't proxy deeper wildcard subdomains for free, I'd have to manually create each subdomain in Cloudflare DNS - defeating the privacy objective.
For now, instead of wildcards, I'm just using URL path prefixes. For example 'smart.home.domain.com' becomes 'home.domain.com/smart/'. This works pretty easily in a docker host with traefik handling domains, paths, and certificates. Some apps don't work under path prefixes without a lot of tweaks. And it works fine if it's one-to-one server to subdomain - but if I want to host another server at home I have to come up with another subdomain like 'app-home.domain.com'.
I could also move everything into something like tailscale. Then at least the domains are private. Right now I use an oauth2 proxy infront of my services - but most of them don't need direct internet access. The issue is, for the services that do need the convenience of direct access, tailscale funnel doesn't support custom domains.³ And even if eventually they do, maybe they'll also limit subdomain depth or wildcards.
Anyway for privacy reasons it'd be swell if deeper level subdomain certificates were part of the free tier.
I have set up let's encrypt with DNS challenge running a wildcard in on a subdomain. Its not a recursive wildcard, but for me, it works good enough. Some of the software I host in my home network expects to run as the root on a web server.
The DNS wildcard points to a 192.168.xxx.xxx address. I don't really care that the IP adres of my home server is public :)
How would any DNS service proxy wildcards? Is that something that’s actually supported as part of DNS? What actually gets resolved in that case? I’ve always had to register every domain/subdomain that should get proxied.
I use .lan..net for my internal servers at work, through cloudflare dns. It's simple, all .lan get resolved to the same IP. And the server has something like caddy or nginx to take the traffic, see the destination, and forward properly into the network
Tarvis allows people to self host apps without managing servers. Each workspace gets their wild card cert at *.weightedreply.tarvis.site.
Then when any app is installed by user in their workspace, they get subdomians under that wildcard without leaking what apps are running there. N8n app gets n8n.weightedreply.tarvis.site and hermes gets hermes.weightedreply.tarvis.site.
The proxy and auth is handled by self hosted pomerium so no dns records are published for any app subdomians under that workspace url.
I am using Google certificate manager which is free to generate and manage these wildcard certs. I know Google is not preferred but that's the only free service I could find to do this.
The slope of addictive drugs with negative side effects starts with alcohol, then comes nicotine, pot, cocaine, crack, fentinal .... and then all the really exotic modern stuff. It is a spectrum. Some argue that there are upsides, and there are certainly uses for all these drugs, but no sane doctor would say they have no downsides, that unrestrained use is ever a good thing.
Alcohol has greater negative side effects than pot, and nicotine is more addictive than cocaine or pot. I’m not sure what you mean by “exotic modern stuff,” but if it includes hallucinogens (what people usually mean by modern/exotic drugs) then they’re not really addictive at all.
I ask because the scale reads more like a morality scale than anything based on actual negative effects, either in the individual or society.
Isn't it silly that this even needs to be a conversation? Shouldn't we be able to write in any language we want and have the bindings for it to work cross platform? And shouldn't AI aid in building those cross-platform tools?
Maybe React Native isn't the right choice - but two tech stacks for virtually identical interfaces is dumb. Three stacks if you include browsers.
Not sure if it is still like this, but jellyfin used to leak massive amounts of metadata. For example by checking the thumbnail paths (which were unauthenticated) you could see what shows/movies someone had.
Might want to warn the "friend" if they don't have auth on the tunnel itself.
They can also take action if they decide you're wasting their bandwidth or (especially) cache space. It's not allowed to host video files on any free cloudflare plan due to cache space.
I received an email regarding the announcement. It didn't include any specifications so I searched "Librem 5 v2" and found this page.
After looking again at the unsolicited email I received - I see the disclaimer at the bottom in italicized text which I've been trained to ignore. It's regrettable the embargo notice was not the first paragraph of the email.
I'm not really sure what to do now. It doesn't appear I can delete a post.
reply